Fix “opendkim-testkey: unexpected reply class/type (-1/-1)”

While setting up DKIM signing with OpenDKIM you run the key test and get:

opendkim-testkey: 'default._domainkey.example.com' unexpected reply class/type (-1/-1)

The DKIM key itself is usually fine. The error means OpenDKIM’s own DNS lookup failed – it couldn’t get any answer, so it can’t compare the published key with your private key.

Step 1 – Give OpenDKIM working resolvers

sudo nano /etc/opendkim.conf

Add (or edit) the Nameservers line:

Nameservers 1.1.1.1,1.0.0.1

Separate addresses with commas and no spaces. You can list more, e.g. 1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4.

Step 2 – Restart OpenDKIM

sudo systemctl restart opendkim

Step 3 – Test the key

sudo opendkim-testkey -d example.com -s default -vvv

Replace example.com and the selector (default) with yours. Success looks like:

opendkim-testkey: key OK

“key not secure” just means the zone isn’t DNSSEC-signed – it’s normal and not an error.

Still failing? Check these

• Is the record published? dig +short TXT default._domainkey.example.com should return your v=DKIM1; k=rsa; p=… record.
• DNS propagation – new records can take time to appear, depending on TTL and provider (some providers publish within a minute).
• Firewall – the server must be able to query outside DNS on UDP and TCP port 53.
• Logs – sudo journalctl -u opendkim --since "10 min ago"

• #dkim
• #DNS
• #opendkim
• #postfix

作者

Inder Kochar

系统与网络工程师 – 我把为客户使用的解决方案整理成文，并在真实系统上测试过。遇到类似问题了吗？

向我求助 → 关于我